Update: To see all of TTAC’s related articles on the subject of Toyota gas pedals, go here:

In yesterday’s post , we offered a bounty for anyone to open up both the CTS (bottom) and Denso (top) Toyota gas pedal assemblies. No one took us up, and no one anywhere else has done it, so we took it upon ourselves . Here they are, both e-pedal assemblies taken apart and examined, in our quest to understand if and what the significant differences are, and how Toyota’s possible “shim” fix would work. On initial observation, it appears that the CTS may be perceived as being the more solidly engineered/built unit, in that the pedal pivots on a traditional and solid steel axle whose bearings are brass or bronze sleeves. The Denso’s whole pivot and bearing surfaces are relatively flimsy-feeling plastic. But that can be deceptive, and we’re not qualified to judge properly if it is indeed inferior or superior. So the question that goes beyond the analysis of these e-pedals is this: are these units really the full source of the problem, or are they scape goats for an electronics and/or software glitch? Pictures and tear down examination and analysis follows:

Update #2: It’s clear to me now that the CTS unit I took apart already had the side cover plates (sheet metal) removed before I examined it. One can see where they fit, and are obviously intended to protect the exposed axle pivot and bushing seen above and below:

We drove out the pivot pin with a C-clamp and screwdriver. It’s a very traditional design, like millions of plain-bearing (non roller-ball bearing) non-lubricated devices used in a huge variety of devices for decades, if not even centuries. The softer brass or bronze acts as relatively low-friction bearing. With the substantial pressure from the springs, it seems relatively unlikely that this would lock up, but that seems to be the concern. It’s possible that there is a greater potential for binding due to the tighter tolerances in the axle/sleeve assembly. A close up of the axle and bearing:

A big question for us was if there are dual springs, in the case one fails. Here is the CTS unit apart. Note that the pointed metallic part on the bottom of the pivot is the magnet that passes between the sensors in the case of the unit, which is how the sensor sends the throttle position signal to the engine controller.

The outer red spring surrounds the inner black coil spring. It seems that the possible “shim fix” that Toyota is considering would be a spacer on the bottom of this spring assembly, which would increase the pressure on it and presumably reduce the likelihood of the pedal sticking. I’m not an expert on springs, but the spring is already pre-loaded (compressed) to some degree when it is assembled, and unless these are variable rate springs, I wonder whether that would actually increase the working resistance of the spring unit. Since I had no problem taking the pedal/pivot unit apart which also houses the spring unit, and reassembling it as well, it would appear that if that route is taken, it should be easily done in a few minutes at the dealership.

To understand that part more clearly, here is a shot of the CTS unit assembled, with the main cover off, showing the pivot arm with the magnet and how it passes past the sensors (Autoblog has a video explaining how the CTS sensor works, but no teardown):

Lets examine the Japanese Denso unit (below, which comes apart by removing the side cover held on by five screws. It is already apparent from the outside that there is no axle pivot that runs through this unit.

The Denso is a dramatically differently designed unit. The pivoting unit (green) is a plastic “bearing” that just sits inside the two outer units. One can see what it bears against in the side cover. The magnet is the square unit in the middle of the green pivot, and the sensor appears to be the round unit inside the side cover. The numerous small bright metal protrusions on the side cover are not identified. I thought they were the sensors, but nothing runs over/past them. Here is a closer look at the spring assembly still installed and the plastic pivot “bearing” surface:

Here’s another view of the Denso unit:

The Denso spring unit, also a double coil unit, has a protective “sleeve” over the inner spring to reduce binding between them, since the Denso unit’s spring is in a substantially curved position inside the housing. The CTS does not have this feature, but it appears that its spring is less curved when installed.:

Subjective impressions of taking these two units apart are the opposite of what one typically would assume. The Denso unit feels “cheaper” in that the whole pivot bearing area is all plastic, and feels relatively more flimsy (that doesn’t necessarily mean it actually is). The CTS unit relies on very traditional steel and brass sleeve bearing that took some effort to take apart. The CTS pedal has no play or wiggle when assembled.

The big question is why Toyota completely redesigned the CTS unit from the older Denso unit. Perhaps they were actually trying to design a sturdier assembly because the Denso unit was in question. Perhaps the Denso unit is actually inferior in certain ways, but Toyota didn’t want to pay for new tooling to bring the Denso unit up to the newer CTS design? Source have told me that the Denso unit is likely to be recalled shortly, and the LA Times is reporting that there are known claims of pedal issues with the Japanese Denso unit.

From our perspective, it seems possible but rather highly unlikely that condensation is somehow causing the very solid CTS bearing pivot to lock up, given the spring tension and the units solidity. CTS claims it has only experienced a very limited degree of stiction at or near the idle point on a very few examples.

A key question is which unit was designed first. The CTS unit was used in Avalons since ’05 MY. Apparently Denso units have been in use before that. The question being: why did Toyota design two such fundamentally different units, and is the latter one designed to address any deficiencies of the older one?

Both units are surprisingly simple and obviously cheap, yet they feel robust when assembled. I believe Toyota has stated that the unit cost is $15 per pedal assembly. The retail price is about $120.

The overriding question is if these pedals are really the predominant or sole cause in any true (non-floor-mat caused) unintended acceleration, or whether electronics are the real 800 lb gremlin in this whole affair. Toyota has not acknowledged that…yet.

Paul, yes, thank you for doing this. Customarily the fix cannot be implemented until some sort of validation prove out testing is completed on the changed assembly. The longest lead is usually environmental cycle testing (ambient near STP, hot +40C, cold -40C, humid, salt, etc.) You can bet all the stops have been pulled out to make sure this happens – statim.

Next a design “deviation” will be approved until the official engineering change notice is released. The TSB is probably already drafted and ready to be sent pending the green light from testing.

I sure hope they found the root cause – intermittant, and multi-causal issues are a bear to fix. You only know you’ve got it when you can make the problem come and go on command. That is, be able to turn the problem on an off at will, then you know you’ve licked it. You can also bet there’s a lot stessed out people working on it. I feel for them.

Another thing, by trawling RAV4 boards for reputable (!) reports of unintented acceleration, I came to the the conclusion that some of those must have a different cause. One member, of example, reported a case affecting a pre-recall 2007 unit.

That’s the part I’m most curious about. Some Hall Effect sensors come with warnings not to use them in medical applications because if they fail, they could cause a loss of life. The question is whether a sensor could fail in a way that would indicate full throttle. There’s a lot we don’t know.

For more information on this type of sensor, check out this web site: http://www.allegromicro.com/en/Products/Design/hall-effect-sensor-ics/index.asp

mcs, that’s what I’m wondering. It does look like they have magnetic field strength increasing with pressure but present at all times, so it seems likely that (as good design would suggest) they use only the middle range of the sensor(s) and can reject either extreme as invalid.

Paul, although the sensor itself may look ‘incredibly simple’, a closer look may allow people like mcs to provide some informed speculation about possible failure modes. For instance, the connector I’ve seen in a Youtube video has six pins, while a typical Hall Effect IC uses three; are there perhaps redundant sensors, or some processing in the pedal itself?

Just to add to that — the report of a Toyota Avalon driver to a dealer with WOT says that “pushing the gas pedal had no effect on the acceleration”. That suggests it was not a case of an insufficient spring failing to return a stiff pedal.

Another question anyone with pedal in hand: is it at all possible that half of the magnet pair could break loose and be pulled magnetically against the other half or against the sensor in between?

Here’s a google query for hall effect sensor failures. This may give everyone a better picture. Also note the manufacturer warnings about these devices in some of the results. Again, I don’t know if this is the problem, but it seems to fit the various failure scenarios better the mechanical failure theories. If I was going to bet, this is where I’d put my money. Read some of the results and come to your own conclusions.

I found a service manual for one of the affected models online.
APP [Accelerator Pedal Position] sensor has 2 sensor circuits: Main and Sub. If either circuit malfunctions, ECM controls engine using the other circuit.
If both circuits malfunction, ECM regards accelerator pedal as being released. As a result, throttle valve is closed and engine idles.

What everyone forgets is that with most of these recalls there is no, AHA! Nothing obvious is wrong so there is no obvious fix. This is why GM or Ford or Toyota can have these aggravating problems for years and thousands of cars.

Yes, Cars are designed by humans, not gods. The sin being the cover-ups. It isn’t like NBC planting model rocket engines and overfilling a gas tank then slamming into the side of a vehicle at twice the stated speed here.

I have never seen a convincing description that the pedal assembly was the problem. There seems to be a lot of “hurry up and do something”. The Toyota folks certainly know the expense ($$$) and time of a recall. But a recall that has to be “redone” because the actual problem hasn’t been fixed?

Bravo, Paul. Can you imagine one of the traditional car books running such an article? It would appear in the “late-breaking news” column in like the May or June 2010 issue…sheesh!
Hey, a guy I know here is a salesman at the local Toyota mega store. I asked him how this development is affecting sales. He said, hardly at all. All they do is look at the mechanism above the throttle pedal. If it grey (CTS) that’s a no-go. If it is black (Denso), then the car is unaffected (supposedly.) Problem solved. Ha!

Exactly: And I was upbraided for suggesting that TTAC articles are “journalism”. The establishment press [supposed journalists] is not asking these questions.

TTAC asks the hard questions and investigates from the Toyota recalls, to the bail outs, to GM’s “bankruptcy” and Chrysler’s chances of survival. It isn’t attaching bottle rockets to the undersides of pick up trucks to instigate an explosion like some “legitimate” news outlets have done.

Can’t imagine this sort of coverage in the mainstream media either, Willbodine.

I disagree with your conclusion. It follows that whatever failures they are as far as sticking would be caused by environmental intrusions, humidity, rust, extremely dirty car interiors as are common here, etc.

It seems to me that the Denso unit would be much more resistant to this type of intrusion.

Looking at the pictures it also makes me think that the washer fix would be crazy as far as liability. Anyone could make up anything they wished. Undoing an interference fit into plastic at dealer level on flat rate would leave them way too exposed to liability, fabricated or not.

It likely would also change the “feel” of the pedal leading to never ending customer whining.

Much better to take a little more time and replace the complete assemblies. What they spend on the part they save on labor. 15$ is what? 2/10ths of an hour flat rate. At that price point it costs the same to replace the part then a dubious fix that will be criticized regardless.

Comparing the 2 assemblies I see one difference that is significant. The Denso unit has that piece of steel inside the outer spring and keeps it separated from the inner spring. Were upon compression the inner spring to get caught in one of the coils of the outer spring and hamper the both springs to move freely the problem might be there. Why did Denso add the, for a better word, the spring separator?

I guess what concerns me most now is there are just a few things that demand one’s utmost attention when building an automobile.

1. starting
2. stopping

and control of speed!

That whole assembly can’t cost than $20.00 and compared to what they spend on starting and stopping it the weakest link of the safety chain.

Bravo Zulu. TTAC is the first and only news source, as far as I know, to take the two assemblies apart and compare them.

It does look a bit suspicious – what could go wrong with these? But you never know. Nasa has experience with catastrophic failure of something as simple as an O-ring.

I’m not so sure about the surmise that it might be an electronic/software problem. Yes, it could be, but why would Toyota want to blame it on the pedal assembly? Most people live with software glitches everyday, we can understand those. The implication, it would seem, is that Toyota will bring the cars in for a new pedal assembly and fix the software on the QT. I have a hard time believing that.

This is my big question. How can such a simple fail safe not be present? The first Audi throttle by wire systems even had a redundant throttle cable. Blows my mind.

Many, if not all, modern cars do not have a redundant throttle cable. Most do have redundant position sensors. None of this will save you if the problem is with the pedal’s physical position because none of these will generate a fault, and they certainly won’t help if your floor mat snags the pedal down.

Most Toyota ECUs manufactured after 2003 (or thereabouts) do contain a flash EEPROM (Electrically Erasable Programmable Read-Only Memory for those of you not of the tech world).

The brake override function will be added at a later time, first to Camry and ES350 models, then to the rest of the lineup by the end of 2010 (so says their press release). This will be done via Toyota TechStream, which provides the flash updates for various Toyota/Lexus/Scion ECUs exclusively (likely encrypted or protected in some form). Remember, it wasn’t long ago Toyota had to reflash the 07+ Camry 4 cylinders to address the transmission hesitation and potential stall.

—
Warning: Technical talk
—

And to be technical, it’s not really software, it’s firmware. Software runs on generalized CPUs, takes up resources, and usually requires some sort of hardware/software interface driver (API, HAL, BIOS, etc) and basic application layer. Firmware is embedded in the ICs themselves, while processing (in Toyota’s ECUs) is handled by a 32-bit RISC CPU (of varying speed; application dependent). Toyota’s ECUs are usually manufactured by Denso, either domestically or abroad. Most of the ECU’s basic instructions are in a secured ROM, while diagnostic codes and such are stored in RAM (short term and long term). Short term RAM is cleared at each shut down. Long term RAM uses a little battery power to keep the information stored for diagnostic purposes, which is why disconnecting the battery clears OBD related codes. I’m not sure where the “intelligent” transmission shift points (i.e. your driving style) are stored. The EEPROM holds all of the programmable parts of the ECU: transmission shift points, VVT/cam phasing, air/fuel mapping, etc. Most modern EEPROMs are redundant, meaning that they have an extra copy of the original EEPROM. Some flashes may modify both. Computer BIOS EEPROMs usually have a fail-safe unwritable byte section in case a flash fails due to power loss.

—

Toyota uses 3 drive-by-wire pedals: CTS, Denso, and Delphi. I have the Delphi unit in my Tacoma. It uses a completely different connector, but is electrically compatible with the other two. I’d like to see the Delphi pedal opened up. It’d be nice to compare all three designs.

I had an interesting cruise control incident in my 05 Tacoma, which might pique your interest into the whole electronic/firmware discussion: http://www.toyotanation.com/forum/showthread.php?t=155137

Note that it was posted in 2006, before all of the media attention. An original case, you might say.

Jason, I am not sure about your picking at the firmware vs. software calling.

I am in a industry whose software package consists of both disk based software and flash based software (both are required for the product). Firmware is just another name for software you don’t want to change later on, but oddly, often you end up changing it anyway. It really is irrelevant what webster’s has to say about this, even it attempts to pronounce a profound difference between the two.

I believe you may have had a point in the old days, when you couldn’t “reflash”, but had to pop a ROM chip. But since the advent of UV responsive PROMS, EEPROMS, and now the standardization of flash memory, the determination between the two is a dead concept and no longer relevant in a modern conversation concerning computer software. You can modify just about anything out there. I am not aware of any serious equipment manufacturer that uses a masked ROM anymore. Not only is it expensive, it’s patently stupid.

My point wasn’t about the cable, just the fact that the software isn’t programed to override the throttle input when the brakes are applied. I just pointed out that when throttle by wire first came out they went as far as the redundant cable, and now Toyota didn’t even program their software to have the brakes override the throttle input.

A lot of folks are also forgetting that brake override systems are not always desirable for the customer. While I personally agree with the left-foot brake for performance driving argument, I’ll leave that aside as the general public wouldn’t consider that an acceptable reason for omission of the system (Porsche doesn’t, and it makes some of their road cars a real pain on the track). To the contrary, here’s a practical example.

I drive a (recall affected) Tundra. I use it frequently for towing (a socially acceptable use for a full-size pickup, no?) At the end of my street, there is an uphill stop, where I have to take a 90 degree turn onto a rural highway with a 50mph speed limit. On multiple occasions, I’ve been stopped at this intersection with trailer in tow, waiting for a big enough opening, and some jerk pulls right up behind the trailer. So my options are A) brake torque to get started, or B) roll backward and give the fellow behind me what he has coming. With a brake override system, I’d have to rely on a trailer brake to accomplish option A, with B being the more likely outcome.

Just an example situation to take into consideration when wonder why these so-called “safeguards” aren’t in place on vehicles from numerous manufacturers.

I think Toyota’s fear is that if this is a software problem that some liability lawyer could come along and demand that they retrofit all of their cars with an old fashioned throttle cable. That would cost thousands per vehicle, like when Chrysler converted thousands of fuel injected 318V8s to carburetor in the early 80s cause the fuel injection system was crap. The estimated cost per vehicle I’ve seen were close to $10,000 per vehicle (in mid 1980s dollars.) Imagine what it would cost Toyota to retrofit thousands of vehicles while they tried to figure out a software glitch?

“Accelerator pedals produced by CTS Automotive for Chrysler Group LLC vehicles are a different specification and design and are manufactured using different production tooling and materials than the pedals produced for Toyota,” Chrysler said in a statement.”

I do embedded programming work (but not for auto companies). I would not be surprised if this was software based on the reports I’ve been reading. It sounds like a problem where a variable overflows, there’s an infinite loop or interrupts were masked and then not umkasked, so the software isn’t getting readings from the pedal.

These aren’t general purpose CPU’s, but micro-controllers where you have to be very careful about the programming, because they’re not running an OS and the programming languages are low-level. You can do some pretty bone-headed things when programming on “bare metal”.

Given the problems I’ve seen in micro-controller code, it wouldn’t surprise me if there was some code that was off by a half word, so the memory location holding the state of the peddle was being overwritten by something else, or the code that reads the state of the peddle is accessing the wrong bits of memory. A common problem is changing the pointer to a memory location, not the location itself; this means the next read would fetch something unintended from memory. This is a common problem bug in C and assembler and won’t even raise a compiler warning. Not seeing the code, one can only guess.

What if it’s a software problem? They eventually expand the recall to include all pedals, and “verify” the repair or “adapt” the replacement pedal” by plugging the car into the dealer’s computer. Meanwhile the car’s software is updated to fix the bug, unbeknownst to the customer.

On my track toy which uses an aftermarket ECM I experienced some very strange behavior best described as the engine completely cutting out under load and requiring an off-on again key cycle to restart with the crankshaft stopping at some point. Nothing I did in swapping hall effect or variable reluctance senders was fruitful. Yet after months of frustration I was given some free updated firmware which disappeared the very nasty manifestation of the particular glitch I had.

If you want to break my trust forever give me a component which puts me in danger (on track loss of power mid-turn at limit could be VERY dangerous in wet conditions). Then blame false culprits for the problem, in effect blaming my work then later reverse your position to mea culpa and ask me to quiet down because I’m saying some less than pleasant things about your product.

It is my understanding that some OBD II systems can update module software levels rather forcefully or at the very least alter coding to reflect the mfg’s desired settings. Once that OBD cable is connected at the dealership big brother is most certainly capable of re-flashing the ECM’s memory. The speed of this operation will be limited by the throughput of the connection. More recent cars will have a higher rate of data transfer to the ECM which means what once took several mins to re-write a megabyte or so is now rather quick and painless. You’ll know for sure if they are flashing the ECM if and when you get reports of cars being down for ECM replacement due to faulted communication and corrupted data in the ECM. There is no way that millions of flashes will be done without a few ECMs being corrupted.

I haven’t yet seen any analysis focused on the hysteresis mechanism, but yet that is likely the cause of this problem (seeing as how its entire role in life is to provide a measured amount of friction in order to limit the return forces and improve “feel).

The shim almost certainly disables the hysteresis mechanism. Any increase in spring preload would only be an ancillary benefit.

I see a lot of people wringing their hands and inquiring as to whether the problem is related to the pedal hardware, or if there is a flaw in the ECU software. Does everyone really want to see this as yet another consequence of mysterious, bug-prone software? Trust me – mechanical problems are far more prevalent in modern vehicles.

I have a difficult time believing that the pin and bushing could get contaminated enough to lock up. From the various pix, looks like you’d need a reverse articulated knee joint and make a regular practice of knocking the mud off your clodhoppers against the pedal body. You’ll find bushings like this in a lot dirtier environments than a car – like portable power tools including my still working 1970’s 3/8″ Sears $7 drill.

If the pin and bushing lock up, then won’t the bushing still turn against the plastic housing? BTW, are there bushings both sides or one side? Not desirable to lose one – it would be surprising if Toyota didn’t test the functionality with a bushing completely missing to see whether the assembly hangs up. Could you jamb the sensor end of the arm and housing sensor plate if that happened? And if you lost a bushing, wouldn’t it be immediately evident to a mechanic? Maybe Paul could reassemble the CTS unit w/o the bushing and check it. Enquiring minds want to know…..

If you can spell EPA, then you have a handle on what’s wrong with mechanical throttles. Drive by wire (“DBW”) throttles make micro-second adjustments to optimize air flow based on what the driver is asking for (Throttle position) versus rpm, exhaust output, etc. DBW is also a key component in many electronic stability control systems as one strategy to regain control of a vehicle is to reduce acceleration.

Too bad most posters aren’t old enough to remember broken throttle return springs or stuck throttle plates, it would help put this issue into perspective.

After swapping a 2V for a 4V setup on a ’70 Cougar I learned a lesson that air cleaner/linkage clearance can change in a bad way when the hood is shut. But like Morea said, it was a quick fix. With throttle by wire it’s hard to determine if the problem is programing, mechanical, electronic or a combination of all. I don’t mean to sound like an old fart but I miss the old days of being able to quickly diagnose and fix a problem. I’m all for keeping things simple. It seems about right now the folks at Toyota would agree.

I thought cars with mechanical throttles had traction control that was capable of applying brakes and reducing engine power. Not sure how that second part was accomplished with a mechanical throttle linkage, but it was advertised as such.

On another note, Volvo had a lot of problems with their first DBW accelerator pedals wearing out prematurely. It seems like they failed in ways which didn’t result in unintended acceleration, though.

I have read that US-built Camrys may have either pedal assembly. Can anyone confirm whether that was for one model year during a parts changeover, or do they continue to manufacture and install both pedal mechanisms concurrently?

Suggestion, try to have the parts oriented in the same position in all photos. Presently, they are a bit disorienting.

Request: Can you please throw up some more photos of the two assemblies? Specifically:
– straight-on views of both sides of the interfaces between lever (both sides of lever) and the housing (one of each side of the housing) of the Denso assy (4 photos);
– 45°-on of the same (4 more photos);

Questions CTS:
1. axle assy:
a. bronze bushings: pressed into housing, or held in bore by snap-in sheet-metal plates? (not shown in your tear down, but evident in Autoblog’s video w/”Sam”)
b. bushings with feature to prevent rotation within bore?
c. bushings have a split, or a continuous wall?
d. the axle is splined, this should prevent it from rotating within bore in lever, true? Was there a press-fit between spline and bore?
e. spring is constrained betw cup/cone feature lever and cup. What is the reaction surface that flat outer side of cup rests against? Is it a snap-in sheet metal plate on side facing dash panel?
f. what kind of clearance betw cup and cup bore in lever?
f1. Possiblity cup could swell and stick in bore? Or bore could swell and squeeze cup?
f2. Possibility of debris being trapped between cup and cup bore causing spring to remain compressed (can you post a photo of the cup inside the lever assembly?)
g. is hall effect sensor in housing completely over-molded or is there possibility of damage during installation of lever into housing?
h. is it possible to hit end of lever against hall-effect housing when lever is being inserted into housing?

Questions Denso (ND):
– does center of hub rotate? if it does not freely rotate without limit, does it rotate a little bit more than max angular rotation of lever?
– the small holes around perimeter of hub in cover, are these vents or are they occluded holes?

Comparative Questions:
– do both assys have the same number of pins in the connector?
– is the arm length and pedal angle, relative to the front (in vehicle) face of the housings the same?
– is the angular displacement (lever travel) of the units the same?
– is the displacement force, or torque to rotate the same?

Initial comments:
CTS:
– double coil in middle of red spring is a due-care feature which maintains co-axial alignment of the spring-pair and thus prevents coils of black spring from wandering in between coils of red spring and preventing red spring from being compressed;
– steel axle pin w/external serrations is a press-fit into lever, to prevent rotation within pin bore, and to maintain axial position;
– if bronze bushings are held into bushing bore by press-fit, then snap-in steel covers could provide redundant axial positioning of the lever within the housing;
– primary positioning of lever within housing is likely accomplished by a surface to surface fit. Sticktion or torque to rotate could be increased by a) swelling of lever increasing width, and/or b) swelling of walls of housing decreasing opening;
– if bronze bushing is not a press-fit into housing, it could be intended to rotationally creep within its plastic bore even as steel axle pin rotates within bushing itself;
– if humidity-induced a) rust on o.d. of pin, or b) swelling of housing squeezes bushing, then 1) SF(spring force) may be inadequate to overcome a higher stiction-induced BF (break-away force) in the rotating system;
– if CTS fix involves installing a washer-shaped shim at one end of the spring, in so doing the spring will be further pre-loaded than it is today (you noticed this when you dis-assembled the unit) which will increase the return-to idle force from the spring;

Denso Unit:
– outer spring is positioned by the arcurate depression in both the housing and housing cover, and constrained by same from bucking sideways as spring is compressed;
– coils of inner spring are prevented from becoming entwined with those of outer coil by elastomeric (i.e. rubber or plastic) sheet folded between them. This maintains co-axiality in spring pair despite side-loading that develops due to curved (non-axial) compression path. By preventing rubbing contact between inner and outer springs, elastomeric piece prevents (or reduces) a) noise, b) removal of paint, c) galling of spring, d) formation of debris due to these factors;
– shiny rows of bumps on inner face of cover are to keep metal circuit tracks positioned between socket and hub during injection over-molding process and cooling (I had considered, but now reject the possibility that they are a Hall-Effect array device measuring inter-coil density, so that as the spring is compressed and the inter-coil density progressively decreases, the reading changes, or the movement of a magnetic feature of which there appears to be none. Such a concept would have other unique requirements and limitations but I leave it in here as a curiousity);
– it is unlikely pedal travel is limited by springs bottoming out coil on coil , but rather by lever hitting stops in housing body. This would prevent spring-related issues similar to those described in a-d above;
– based on initial photos, it appears cover plate contains either a hall-effect or strain-gage sensor, such that as pedal is displaced the square form-fit between center of lever and cover plate causes a displacement in this sensor.

These are my initial thoughts based on the photos you posted and the descriptions of the “shim fix” in the media.

I’m still not convinced there isn’t going to be a “voluntary” re-flash while vehicles are in the shop for pedal service (provided the vehicle has the necessary EPROM.

Adding a shim is not likely to increase the spring force in any way that will be noticable to the driver because the human leg has so much more mechanical advantage.

Re. Interchangability le it can only be due to a) packaging/human factors, b) differences in pedal travel or force to rotate, or c) dissimilar signals from assy to ECU (this last one would likely require a reflash).

Paint like this could be used to indicate:
– supplier;
– spring rate;
– change level status;
– QC check for a feature either on the spring, or to ensure the plastic centering sheet/separator/isolator was installed prior to insertion into the outer spring.

Also just noticed, in the square, in the center of the lever, a small plate with the blue edge, such a part would be consistent with the magnetic element in a non-contacting Hall-effect sensor (based on this I no longer believe the Denso unit could be using a strain-gage-based sensor). The blue paint on the edge of the plate could be there for reasons similar to those as the blue paint on the spring.

Robert, thanks for your excellent comments and questions. I’ve been out all evening, and right now I can’t address your points in detail.
I don’t have access to these units anymore; it was a brief unexpected opportunity that the right person provided me access and tools for a short time. I tried to order some from the dealer, and told they would be a few days to a week to get, but he was willing to sell/order me a CTS unit. There is no order to not sell them! Probably that fell through the cracks.
I will respond to your points further as soon as I have some more time. Thanks,

Robert, some responses to your individual questions and points:
CTS axle assembly bushings pressed into both sides of housing; no retainer or clip on the outside (as per picture at top). Rotation of bushings? Highly unlikely, because pressed in (although it didn’t take a proper press to take them out or replace. Just simple hand tools). Bushings have continuous wall.
Yes to your splined axle question: pressed into plastic hole of pedal. No to sheet metal spring reaction surface; plastic. Cup or bore swell? Plastic swells? Clearance on them seemed quite loose.
Questions f2, g, and h. I would think so. I had to move the lever around a lot in getting it back together. But I can’t verify for certain.
Re: Denso unit. Don’t know if center part of pivot moves. Small holes are metal, related to wiring. Wiring was confirmed to look exactly the same: number, spacing and details of wiring connector housing on assembly. I’m certain they would both plug inot the same connector from the wiring harness.
Didn’t measure movement and torque, but subjectively they felt very similar.
Your comments on both units seem accurate and relevant. Thanks.

You are correct Walter the “shiny rows of bumps” have nothing to do with the magnetic circuit; they are the result of insert moulding needs.

The metal box in the pedal diverts field through the Hall sensor which is moulded within the cover. This is a common way to generate an angle measurement from a linear Hall; I believe this method is patented by MMT (Moving Magnet Technologies) in France.

If a spring shim can fix the problem, that would be great… strange but great. I suspect that the linear Hall IC’s failure modes are also under consideration.

If reports are accurate that the problem typically develops in cars with more than 30,000 miles, this would be a strong argument for a mechanical problem rather than a software bug within the core throttle control programming. Software cannot wear out…and should either work properly, or not at all…through the life span of the car. That said, sensors and other inline mechanical devices could fail or insinuate noise into the circuit that creates an “out-of-limit” input to the control unit. This happened on the Eclipse light jet and caused a “run away” engine accident. In this example, a ham handed pilot pushed too hard on the thrust lever, physically deforming the mechanical assembly. Once the lever exceeded the range anticipated by the fly-by-wire programming, the engine went to full throttle and stayed there. Since the Eclipse is a single-engine aircraft, the engineering rationale seems reasonable, i.e. under most instances I would rather have too much engine than none at all. There is, however, no rationale for an automobile to have a full-throttle default. Again, this suggests a mechanical failure. Strange though…the engineering approach is sufficiently different between the Denso and CTS that is seems extraordinarily unlikely that they would have a similar mean-time-to-failure/fault.

I think if you look into the complaints at the NHTSA website, you’ll find a wide range of vehicle ages for when the failure occurs. Sure, the failures skew toward vehicles with more miles/years, but that would be tru for a software problem as well. The more time, the more chances for the software glitch to pop up. I did look into this several years ago for my mom’s Corolla (predates the recall vehicles), and there were a few complaints identical to my mom’s. Sitting at a complete stop, the engine begins accelerating from idle to several thousand rpm. That is not the description of a pedal that was already depressed sticking nor the description of someone accidentally hitting the accelerator instead of the brake pedal.

The unidentified double row of pins mentioned by Paul may very well be to prevent the spring from digging into the plastic causing chips which might gum up the works. Do not know what the single row of pins would be for though. I sure do hope that Toyota gets this sorted out quickly though. If something were to happen to my wife driving our 2005 Avalon, I do not know if I could live with myself, although our car has never exhibited any problems with the exception of the oil hose recall endemic to this engine series.

To me, the pins have no other function (as described in my analyis above), than to keep the tracks aligned within the mold as the plastic is injected.

Some suggestions to set your mind at ease:
– does it have CTS or Denso unit? Did you check? (If Denso, perhaps you can feel better at ease – but not entirely);
– how many miles on your car? (If over 30k, and an average 5y old car should have about 60k miles, then recognize you are approaching the believed mean-distance to potential failure of 38k miles;
– have you taken you wife out to the car and instructed her as to safety countermeasures? If not, do so.
– Explain to her:
0. Always have your belt properly on and snug.
1. Drive as if this might happen, be aware of your distances to other objects, leave space, pay attention to traffic, lights, and pedestrians, etc.;
2. If it happens then:
– 1. both feet full on the brake, do not pump;
– 2. trans into neutral (some cars move without a detent interlock into D from N and vice-versa … assuming you have a tunnel mounted automatic transmission selector, see if you can slide it from D to N without having to push in the button that you use to move out of park.
– 3. (assuming you have a key and no start button) turn the key from engine run to the accy position;
– 4. stress not to remove the key, else column locks.
– 5. go to a safe place, like a mall parking lot, and practice this to become comfortable with it.

It would be impossible to keep this from becoming known, just too many dealers, too many mechanics, too many people that will tell friends, or even post it on the mechanics blog sites…

If they try to sneak this in, it will come out, and their reputation will be Mudd.

For the first time since the emergence of this issue, I had a chance to skype my mom and sisters (oldest sold her Toyota Matrix last summer), they all have the same opinion on the situation: Toyota got greedy and put its profits before concern for the customer; they think Toyota is hiding something.

Again, I have not influenced their opinions in any way, and my survey was not scientific, but if they are representative of owners and potential owners then Toyota is in for a rough patch…

Pin through bronze bushing is a situation extremely unlikely to ever fail. The bronze won’t corrode. If the pin is made of the proper material, it won’t corrode. The clearance between the bushing and pin is generally small enough that large dirt particles can’t get into the bearing surface, and small dirt particles will work their way out just as easily as they got in. The movement is slow enough that lubrication doesn’t matter. Bronze bushings have been used for well over 100 years. I find it extremely unlikely that this is responsible for what’s happening.

The serrations on the pin press-fit it into the pedal. This is also extremely unlikely to ever move. The bushings press-fit into the housings – also unlikely to ever move.

The sensor is a non-contact-type that won’t wear out.

I just can’t see this mechanism being responsible for this. That, on top of the report from the driver who pulled into a dealer with the engine running away, after having gotten there by shifting between “drive” and “neutral”, with the engine unresponsive to the accelerator pedal, suggests that mechanical sticking of the pedal mechanism isn’t what’s happening here.

I, along with others, think the real fix will be in the software flash that is probably going along with the sensor replacement …

And yes, it’s idiotic that Toyota didn’t have the logic to cut, or at least limit, engine power when the brake is being pressed. Said software flash is probably going to add that.

I’m not so sure about the surmise that it might be an electronic/software problem. Yes, it could be, but why would Toyota want to blame it on the pedal assembly? Most people live with software glitches everyday, we can understand those.

As someone who has had to manage a call-centre, I would add that most people actually do not understand software glitches. And yes, this includes people who should know better.

A general-purpose computer (like your PC or Smartphone) is very different from the computer in a piece of control equipment. For one, the operating system, inputs, interfaces and sheer codebase size in a PC is orders of magnitude larger, and built by many disparate teams. Control software is smaller, simple, has an easier set of inputs, has a more encapsulated development and, quite frankly, is subject to better quality control.

It’s not easy for software like this to go spontaneously bad in the same way that, say, Microsoft Windows would. If you could, you could also reproduce that failure in factory-fresh units and via synthetic because, again unlike Windows et al, control software doesn’t suffer “rot”.

I’m not saying it’s impossible that there could be bug, but it would be very unlikely.

Now, what you can do is feed such a computer bad data. Most of the ways you could do this would have redundant sensors and would check against each other and probably fail the system entirely (eg, go into limp mode) in the event they’re inconsistent or insane, but there’s one very easy, and utterly undefeatable, way to tell the computer to open the throttle, and that’s to tell it that the accelerator pedal is down. So that’s where you look, and it’s likely where the problem actually lies.

This is why I’d totally believe the floor-mat or bad-spring scenarios: they act directly on the part of the system where there’s no redundancy and no sanity-checkable input.

The problem is that people inherently distrust complexity and trust simplicity, even when simplicity usually means there’s also a simple, easy way for the system to screw up and complexity means multiple failsafes. Call it inherent Luddism.

I didn’t mean to suggest most people understand software glitches in a technical way but rather that they understand that computers malfunction frequently. We have all had our desktops crash (ok, maybe not the MAC users) and many of us have had computer problems with furnaces, washing machines, and other appliances.

PN was speculating that the real problem is software/electronics but Toyota is blaming the pedal assembly. I was (trying) to express skepticism that Toyota would prefer to blame a lever and a sensor rather than the “real” problem of software when most people would think “yeah, those computers will NSFW-up on you” whereas they’d expect a pedal assembly to be designed and built w/o flaws.

I don’t buy what you are selling on the software complexity issue on modern vehicles. I am a software engineer, but I do not write software for embedded control systems currently (I have in the past, but not car motor controls).

You are correct that engine computer software and desktop application software are different beasts, but to say desktop software has much more complexity is ridiculous.

The software you run on your PC has been suffering from feature creep for ages. This results in growing code bases, and complex execution paths as these features get plumbed into the application’s overall architecture.

What people don’t realize is that the very same thing is happening to engine computer software for their vehicles.

To name a few: Vehicle stability, traction control, fly by wire throttle, hybrid systems, and a myriad of sensors to monitor all of these various subsystems. On top of that, you have multitasking operating systems that balance the recording of data from all of these sensors, with the real time demands of engine control. You have ODB-II diagnostics communications (and whatever proprietary reporting methods built on top of that). Control software is no longer a simple loop with a delay or poll at the end to restart the cycle. Those days are long gone. The four systems above, vehicle stability, traction control, FBWT, and hybrid — all require complex control algorithms, with special attention to preventing resonant conditions (common in the feedback control world where complex mechanical systems can respond differently in different areas based on inputs to other areas of said system). And that’s the “easy” part.

These systems also have to deal with changing sensor inputs in the normal case, and keep going *reliably* even when some of these systems appear to have a fault. The software has to ferret out the bad data, and then based on the software engineer’s vision — provide a suitable replacement for that data synthesized from other inputs. The software also has to decide between whether a sensor is in a temporary fault mode that it will recover from (something not preventable), or if the sensor needs to be replace: a screw up here could result in the dreaded pedal problem these toyotas are seeing (I said “could”).

If Toyota had not prescribed the shim fix, I had several theories, based on the fact some reports say the physical accelerator is not stuck:

(1) Steel pin became magnetized and dominated the field applied to the HE sensors. This can happen with repeated shock, or the magnetic fields from the proper position magnets in the mechanism.
(2) electrical system fault elsewhere in the car either induced a current in HE lines and caused them to “lock state” (or did the same with a power glitch to the sensors).
(3) different HE sensors were substituted for the original design type, but those sensors were not verified properly, and did not have the required MTBF — this would have been odd that both failed at the same time — unless a SW bug caused the computer to not assume the worse and drop throttle.
(4) FBWT algo in ECU went through corner case emissions control processing, and a code bug here resulted in WOT rather than TCT signals to throttle servo.
(5) Throttle servo sticking at or near WOT.

For me, 1, 4, or 5 would have been most likely since I would have figured Toyota and their suppliers would have not made any stupid moves for parts substitutions without lots of verification.

Finally, I agree, this could have been alleviated greatly with proper drop-throttle-on-brake response from ECU. It could have also allowed Toyota engineers to have the ECU gather data about times when ECU detected throttle open with brakes applied, so they could verify it was not a sensor subsystem failure (i.e., the ECU could throw a code like “PXXXX accelerator depressed while brake engaged”). As many have noted, whether or not the real problem is the ECU programming or not, we’ll never know — I suspect Toyota will in fact apply a patch to drop throttle on brake when they perform the recall. That patch may have a fix for #4 (if it existed) in it, but we’ll never know unless someone reverse engineers the patch.

Another problem this whole thing brings to mind is the neutral position for the auto gear shifter: I have read that the “death cars” with this problem have had these odd shift gate patterns that make finding neutral in a panic situation very hard to do. Any body know why the manufacturers have gone to these complex shift gates in the center console? Is it merely to “look cool” or does it serve some purpose? The old standby of a stuck accelerator was to shift to neutral, drive to roadside, and then turn off the car, but the NTSA has hinted that modern transmission shifter patterns no longer make that easy to do while managing the other aspects of the emergency. Additionally, I have read that some trannys won’t shift to neutral under WOT, which is REALLY BAD (™).

You are correct that engine computer software and desktop application software are different beasts, but to say desktop software has much more complexity is ridiculous.

No, it isn’t. At last official count, Windows 2000 (ten to twelve years ago, for the record) was some twenty million lines of code for the core operating system. The current Linux kernel is about 13 million, and the kernel source is functionally useless on it’s own. Kernels don’t usually fault, mind you, so if we expand our perspective to the things that do (drivers and userland) we’re well over thirty to fifty million and into bug lists that run into the thousands. Much of this has been written by hundreds of different people across many organizations, and installed on thousands of permulations of hardware.

Are you telling me the software to monitor a few known inputs and outputs on a tiny, well-known and very simple hardware platform can even compare to this? Excluding telematics and infotainment, I have real trouble believing it could reach more than a hundred thousand and likely a lot less.

This is why it seems far more likely we’re dealing with mechanical issue.

I agree that your analysis may very well be the case, but why would software re-programming be a worse scenario in Toyota’s or the NTSB’s eyes than pure mechanical failure of the pedal?. I am begining to believe that there is something going on here that none of us has yet to grasp.

“… why would software re-programming be a worse scenario in Toyota’s or the NTSB’s eyes than pure mechanical failure of the pedal?”

Just speculation, but a combination hardware/software problem, like a fundamental flaw in the design of the PCM that precludes a brake/throttle interlock, could require replacement of the PCM in millions of affected vehicles, at hundreds of dollars per vehicle. Not to mention the problem of producing so many PCMs in a short period of time.

I think the reason that would be much worse is the effort it would take to identify a software problem is much greater. I’m just a lowly engineer whose computer programming experience ended in college with Fortran, Pascal, and the like, but trying to find that misplaced letter in 200 lines of code could sometimes be maddening. Now imagine finding something like that or a logic problem in 10 thousand or even millions of lines of code. Even a young hotshot programmer is going to have problems with that. A software problem could also effect even more vehicles. How long have they been using the same controller for the accelerator pedal? Is it based on a previous program? Could that previous program have the same bug? Way mroe “ifs” and less definitive answers if it is software and not a physical problem.

One more thing… The way they keep expanding the recall, and staying in the news, is eerily reminiscent of the Audi recalls during the 1980s.

From what I can gather, Audi first blamed the owners, then did a recall, then did another recall, and another. Three or more dealer visits for repairs in a short period of time is grounds for getting rid of a car nowadays.

From what I can gather, Audi first blamed the owners, then did a recall, then did another recall, and another

Yes, and it ended up being a complete crock in Audi’s case because a) the problem was pedal positioning (it was closer than many American cars and b) the media at the time flat-out lied to make the story.

Audi did handle the matter badly, and Toyota is doing it better, but you have to walk a fine line between “Accepting the issue” and “Opening yourself to unwarranted liability” that won’t solve everyone.

A few years ago I had a job making defective parts for Toyota that were also in the center of a recall.

From 2002-2004 I worked at a manufacturer of plastic, blow-molded fuel tanks for several automakers. (Ed’s – if interested I’ll give you the name of the company. You should have my email address.) In early 2003 we got our first contract building parts for Toyota, for the 2004 Sienna.

We got the line up and running on schedule, but shortly after the start of regular production we were shut down because the tank leaked during IIHS crash testing. All hell broke loose. We had Toyota engineers swarming over the floor of our plant but the cause was quickly traced to a failure in the design. One of the standoffs was not large enough to resist tearing when the tank was deformed.

This is where what I saw might be relevant to what’s happening now with CTS and Denso. When news of the cause filtered out I asked our production manager if we were in danger of losing the contract because of the design fault and he said we were in the clear because Toyota had done all of the design work on the tank.

This was a very unusual arrangement. Our company basically invented blow molding gas tanks and we had been doing it for the auto industry for decades. I was told that customers normally worked with our engineers on design because we knew how the materials performed and how a tank had to be built to pass crash tests for different markets. Toyota arrived with their completed design and we were only expected to build it to their specs.

Toyota issued a voluntary recall (ID # 03V291000) for the tanks and after several months of 24/7 production we were able to satisfy the recall, the vans that had been in Pierceton, IN without fuel tanks and parked in a field while waiting for new tanks (production was not stopped) and the regular assembly line output.

This is why my eyebrows went up when I read Toyota blaming CTS for a faulty design. They make parts for identical models through their Denso division and they allowed a US contractor to design the part on their own? That didn’t smell right when I read the story. Expanding the recall to Europe (involving Denso parts) and now this tear-down exam of the two isn’t changing my mind.

They’re both meant to be replaced, if the car is under warranty. Out of warranty, the Denso’s design makes it possible for the owner or mechanic to try to clean the contacts or at least determine the cause of failure.

Was going to check today which pedal assy. we have but we have a raging snowstorm outside and it is about 16 degrees out. I will look first thing in the morning, however from everything I have read all Avalons are mfgd. in Kentucky, and those supposedly use only the CTS pedal. As to your other points: When this problem was first announced we went out to the car and I discussed all of the solutions you have mentioned. I sincerely want to thank you for taking the time to point out all of the steps necessary to stop the car in an emergency. You are a true gentleman. I like your rationale for the existance of the pins. My earlier post makes no sense upon further review as to the existance of these pins. I also like your detailed analysis above of both pedal assys, and hope that the additional questions you have raised will shed additional light on the situation. My wife also wishes to thank you for concern. BTW out car is an Avalon limited with the pushbutton start (I know I know!) with about 42,000 miles.This is right around your mean time to failure point of 38,000 miles. You have absolutely helped. Thanks again.

Hi BMWfan! You’re welcome. I’m glad I can be of some help. I get frightened sometimes when after typing in the little edit box window I submit and then see the length of my latest “epistle” … it takes quite some time to study and think thru an issue, and then type and edit it to be as short and understandable as possible (I’m sure this is what Bertel, Ed, Paul, the Professor and Mary Ann all have to contend with on a daily basis so it’s normal.)

Ok, given your having a start/stop button, I want to ask you questions:
– Do you have to insert the FOB, or any other object into the IP, or column shroud before you can push the button to start the car? Or is it a full “key less go” system, i.e. you unlock the car with the FOB, climb in, push the start button and go?
– When your car is off, and locked, is the steering column locked? Are you able to rotate through 360° without it locking? If so, this means you have no column lock. If it locks, you then have what we call an ESCL or ECL ((Electric (Steering) Column Lock))…
– If you have an ESCL, when you are in the car (locked by the FOB), and you unlock the car, can you hear the electric motor, would be located somewhere in the column, in the ESCL withdrawing the lock bolt out of the column shaft? If so, when does this happen?

Finally, if you have an ESCL-equipped column, I hope you are willing to do a test for me to see what conditions must be satisfied before the column locks (please make sure you do it under the safest conditions possible, e.g. empty end of the mall parking lot.) Try cruising at a low speed, and with the trans in drive (then repeat in neutral – obviously if the car is moving, you can’t try park), push the stop button until the engine stops, does the column lock too? Or does this only happen if the wheels stop turning? Or only when the wheels stop turning and you shift it into park?

I’d be interested to know. Toyota obviously blew-it by not incorporating a “full-brake forces engine to return to idle” function into their corporate safety strategy … I’m wondering if there was any similar failure of conceptualization with respect to the ESCL functional modes.

Disclaimer: Please recognize if you try this test, you do it at your own risk, so if you blow yourself up, neither I, nor TTAC, will accept any liability. ;O)

FYI: Regarding steering wheel lock on the Toyotas with pushbutton start: The lock does not activate until a door is opened after the engine is shut off. So, as long as no one tries to bail out after you shut the engine off, you can still steer the car.

A prime item for decontenting, which would cut cost, save weight, improve reliability, but not comprimise the driver’s experience, is the ESCL unit. These devices are expensive ~20 bucks/unit, problem-prone electronic-electro-mechanical units.

Some OEM have already begun to eliminate these for vehicles sold in the US-market.

Some OEM have already begun to eliminate [steering column locks] for vehicles sold in the US-market.

Are you certain about that? The reason I ask is because these are (or perhaps were) required by Federal Motor Vehicle Safety Standard 114, which first took effect in 1970. The original purpose of this was to reduce the number of accidents and fatalities, which were caused by stolen vehicles in disproportionate numbers.

Could you get another CTS pedal assembly from another non-Toyota vehicle for comparison? Toyota isn’t alone in having UA problems, but they are having them disproportionately compared to other car makers.

Supposedly the Honda/Nissan/Chrysler units are a different design. It might be interesting to see if they have the same pin/bearing design or something different.

… Toyota has found things, and perhaps will keep finding them, that conceivably under some circumstances could cause a gas pedal to stick or a throttle to remain open. Toyota may or may not have a legitimately bigger problem with unintended acceleration than other manufacturers, but Toyota clearly is hunting desperately for some problem, any problem, it can declare “fixed.”

First it was floor mats; now it is floor mats plus a tendency of certain gas pedals to stick when worn, overheated and/or exposed to condensation. Hmm. Is this finding a product of dissecting actual incidents or a product of working overtime in the lab? …

For its part, Consumer Reports examines a single model year, 2008, and finds 52 complaints against Toyota, amounting to 41% of all complaints against 22 car brands even though Toyota represented only 16% of the market. …

… SUA complaints afflict all manufacturers without a cause necessarily ever being assigned. Strange things happen in small numbers when you put millions of cars on the road. …

Overlooked, however, is that Toyota already had been under fire from trial lawyers and Web sites specializing in SUA since the mid-2000s. Toyota’s first recall of floor mats in Camry and Lexus models actually came in October 2007, …

Overlooked, however, is that Toyota already had been under fire from trial lawyers and Web sites specializing in SUA since the mid-2000s. Toyota’s first recall of floor mats in Camry and Lexus models actually came in October 2007, …

When you’re #1, you’re a target.Toyota’s pockets are deep – as Willie Sutton would say, “That’s where the money is.”

The real threat comes from those who will blame every accident on whatever SUA gremlin-of-the-week is making the media rounds. On the plus side, the Toyota-owner demographic is much less litigious than GM or Sebring types.

The CR report found that Ford had 28% of the UA claims w/ only a 16% market share. Considering that GM, Honda, etc only comprised around 5% each that is a pretty big discrepancy. When does the Ford witchhunt start?

Here’s what I found in the factory manuals for the 07 camry I4 (I’m assuming it’s representative of the SUA-afflicted cars). Executive summary: The gas pedal has redundant sensors, & the ECM closes the throttle if they both fail And, the throttle servo motor’s position is monitored, and if the physical position is not what the computer expects it should be, it closes the throttle. The redundancy & fail-safe design sounds adequate on paper. This leaves mechanical pedal failure as the likely cause of the SUA, IMHO.

The Accelerator Pedal Position (APP) sensor is mounted on the accelerator pedal bracket and has 2 sensor circuits: VPA (main) and VPA2 (sub). This sensor is a non-contact type, and uses Hall-effect elements. The voltage, which is applied to terminals VPA and VPA2 of the ECM, varies between 0 V and 5 V in proportion to the operating angle of the accelerator pedal (throttle valve). A signal from VPA indicates the actual accelerator pedal opening angle (throttle valve opening angle) and is used for engine control. A signal from VPA2 conveys the status of the VPA circuit and is used to check the APP sensor itself.

The ECM monitors the actual accelerator pedal opening angle (throttle valve opening angle) through the signals from VPA and VPA2, and controls the throttle actuator according to these signals

If the ECM detects the abnormal signal voltage difference between the two sensor circuits it switches to limp mode. In limp mode, the functioning circuit is used to calculate the accelerator pedal opening angle to allow the vehicle to continue driving. If both circuits malfunction, the ECM regards the opening angle of the accelerator pedal as being fully closed. In this case, the throttle
valve remains closed as if the engine is idling.

The throttle actuator is operated by the ECM, and opens and closes the throttle valve using the gears. The opening angle of the throttle valve is detected by the Throttle Position (TP) sensor, which is mounted on the throttle body. The TP sensor provides feedback to the ECM. This feedback allows the ECM to appropriately control the throttle actuator and monitor the throttle opening angle as the ECM responds to driver inputs.

The ECM determines that there is a malfunction in the ETCS when the throttle valve remains at a fixed angle despite a high drive current from the ECM. The ECM illuminates the MIL and sets a DTC.
When either of these DTCs, as well as other DTCs relating to ETCS (Electronic Throttle Control System) malfunctions, is set, the ECM enters fail-safe mode. During fail-safe mode, the ECM cuts the current to the throttle actuator off, and the throttle valve is returned to a 6° throttle angle by the return spring. The
ECM then adjusts the engine output by controlling the fuel injection (intermittent fuel-cut) and ignition timing, in accordance with the accelerator pedal opening angle, to allow the vehicle to continue running at a minimal speed. If the accelerator pedal is depressed firmly and gently, the vehicle can be driven slowly.

I’m a similar skeptic when it comes to a software glitches. While I wouldn’t rule them out 100%, these systems can be tested quite thoroughly.
I’m aware of software and mechanical safeties in hydraulic systems where a wrong indication can easily kill or maim an operator. Any (of several) independent switch fault indicators will default the whole system to ‘safe’ mode.

I’m making an assumption here, but for the sake of noise immunity (as well as redundancy) wouldn’t it make sense that the VPA Hall-Effect sensor output a 0-5 Volt signal, and the VPA2 supply a 5-0 Volt signal for the same pedal travel? That way, a “non-zero” signal would always be available (once summed of differentiated) until a fault occurred.

lahru

“Comparing the 2 assemblies I see one difference that is significant. The Denso unit has that piece of steel inside the outer spring and keeps it separated from the inner spring. Were upon compression the inner spring to get caught in one of the coils of the outer spring and hamper the both springs to move freely the problem might be there. Why did Denso add the, for a better word, the spring separator?”

I agree that the “shim fix” could only be applied to the return spring ass’y, either on the outside of the outer spring, or between the inner and outer springs. The distance of the springs from the pivot point is less than in the Denso assembly, implying more curvature (bending) of the spring, making it more likely to rub against the plastic housing, eventually leading to sticking. The pivot axle seems very unlikely to be a source of the stiction.

Re having VPA2 signals ranging 5-0 while VPA ranges 0-5: I double checked the diagram, and they both go 0-5. The VPA & VPA2 pins are adjacent on one of the connectors, which doesn’t seem like a great idea (higher probability of shorting if connector crushed); however, a pedal Hall sensor or the DAC on the ECU input would also have to fail for this to cause a misreading, and two PoFs are pretty unlikely.

There are two Hall sensors. And, there are two magnets attached to the pedal per the electrical schematic*; one for each Hall sensor.

* The “two” magnets could be implemented with one physical magnet by positioning one Hall sensor each at the N & S poles. I mention this b/c the picture of the Denso unit appears to have one physical magnet (unless another is hidden on the other side of the pedal arm).

It still seems odd – my past experience in electronic and pneumatic control taught me that zero anything (Volts, Amps or Pounds per Square Inch) is a no-no, as electrical noise (or in pneumatics, relying on minimal hysteresis of a mechanical system under the transition from zero to non-zero mechanical load), results in ambiguous and non-linear information to be transmitted in the transition from zero to non-zero analog states. If this is a pulsed digital signal (PWM), then noise immunity is much less a problem, but I believe Hall-Effect sensors don’t operate in this mode.

@Ihatetress: I’m a similar skeptic when it comes to a software glitches. While I wouldn’t rule them out 100%, these systems can be tested quite thoroughly.

I could regal you with a lot of stories from back when I worked for the Peoples’ Car Factory. One was internally called the “Kaffeetassen-Fehler” (coffee cup bug.)

It happened only in America. Only in wintertime. People would get in their car, drove a few hundred feet, and the darn thing went into limp.

Nobody knew why.

Finally, it turned out that in Winter, some people went outside, started their car, then went back in, had a cup of coffee, and then went back into their now toasty conveyance. For some reason, the computer thought this was abnormal. Another reflash.

Next interesting item: Most new cars don’t have one computer, they have tons of them. The Phaeton had 56, connected by 3 CAN busses. Internally, we bragged that the Phaeton has more computers and more networks than a small business.

Later volume models such as the Golf had some 30 computers. Actually, there are computers in some parts, and after a repair, everything has to be flashed to the same version, which is a nightmare.

That stuff got so complex that no mechanic and no diagnostic computer could understand it. So we started the Herstellergestützte Reparatur (Manufacturer-Aided Repair) where an engineer in Wolfsburg looked at the screen of a VAS 5052 connected to a VW in Timbuktoo, and told the poor soul in Timbuktoo to swap injector #3 …

Sometimes there is a computer that cannot be reflashed, deep inside a part, such as the early Touareg tranny. And when that computer has a bug ….

Then there was the matter of the “Eismotor” where some vents froze up on an engine of the Golf and its sibling at Seat. Which caused the engine go boom. Wonders of wonders, it never happened to its sibling at Skoda. Nobody ever found out why.

I’m making an assumption here, but for the sake of noise immunity (as well as redundancy) wouldn’t it make sense that the VPA Hall-Effect sensor output a 0-5 Volt signal, and the VPA2 supply a 5-0 Volt signal for the same pedal travel? That way, a “non-zero” signal would always be available (once summed of differentiated) until a fault occurred.
That would be better, but in the CTS design they vary the field with a pair of tapered magnets (the TTAC pictures don’t show this well), so they’d need a second pair for an inverse signal.

The two sensors are mounted at different points along the path, so the second one always returns a slightly higher value than the first. This allows the ECU to check for a short (same voltage from both sensors raises fault code P2138) and other failures (voltages too far apart).

Incidentally my Honda uses exactly the same arrangement, down to the fault codes. I don’t know whether this is standardized, or they have suppliers in common.

Good investigation. If both signals are going 0-5 volts together, what happens if the pedal sensor loses its ground reference voltage? Does the sensor module have a single +5V and single ground reference wire, or are they completely separately wired all the way back to the ECU? Is the ground circuit shared with any other sensors or devices?

It sounds as if a few folks replying in this thread are at least somewhat familiar with how “control reliability” is done in modern industrial safety circuits. A lot of the time, the safety controllers send pulses through the signal circuit to test whether the safety device is properly connected on the correct circuit and isn’t shorted-to-ground or shorted-to-power or crossed with another signal.

VW’s brake pedal switches have one circuit that’s normally-closed and another circuit that’s normally-open to address the possibilities of ground faults, open circuits, etc. And Toyota isn’t using them at all …

FWIW, my 4 cyl 5 spd 2001 Honda Accord had a problem with the clutch pedal return spring breaking. The car was out of warranty so I ordered the spring from Honda and replaced it myself. This broken spring was not a stout cylindrically coiled spring as pictured in these two Toyota assemblies. Instead, the spring looked more like a very delicate light design, and I braced myself into thinking that this is one repair that I would probably be repeating. But so far, it has hot been repeated.

i’m not saying that you won’t have an under-dash (or under hood experience with this component again, but please keep in mind, esp. for things like springs, or bolts, that there are a multitude of factors that play into the durability of such components. Consider:
– coil diameter and cross-sectional geometry;
– whether the spring wire was drawn just prior to bending and whether the die had a surface defect which affected the cross sectional geometry of the spring;
– chemistry of the steel (not every possible variation of a steel charge going into a component can be tested);
– surface defects on the grippers holding the workpiece (the piece of spring steel being bent and twisted), or the dies over which the part is being bent and twisted;
(note: bad tools that allow nicks or scratches in the wrong place on a spring will create a stress-riser which will shorten B10 life.)
– insufficient or inappropriate lubricant in the forming process;
– incorrect heat-treat process;
– incorrect (bad) design leading to stress risers which promote fatigue failure;
– incorrect testing, either under inappropriate (usually omitted real-world) conditions (temp, humidty, contaminants, vibration) or too small a samples size, or wrong cyclic rate, loads, or fixturing.
– testing to a bogey (i.e. number of cycles) instead of to failure, combined with an incorrect assumption of the maximum number of cycles a component will see in the field (i.e. testing to too few cycles and calling it good.)
– assembly of the assembly to be tested in a prototype shop that doesn’t properly replicate the later production environment, thus missing an assembly-related root-cause (sorry Mikey – but as we both well know, these sure do happen… usually by accident, occasionally due to insufficient training, rarely deliberately…)

One fact I see here that I have yet to read about (unless I missed it. If I did – sorry Robert ;) ) is that the pin and bushings on the CTS unit is open to the elements. With the Denso unit being sealed I think it is a huge advantage. Am I wrong in this thinking? I’m not an engg like my brother or anything. Just a Toyota service employee ;)

Once again – I’m puzzled by the missing cover plates on the CTS assembly in this article – they even appear on the previous TTAC article on the subject (where the photo was taken of the pedal ass’y installed under-dash)

Hi Philip, IIRC, the video I saw on the other chanel, and even the pics of these assys in-situ (i.e. installed in the vehicle) clearly shows snap-in sheet-metal plates covering the bushing-axle interface. Paul stated, however, that these were absent from the new CTS unit he tore-down.

I wondered about the plate, looked in the net, see pg.3 of the Toyota document … http://www.tuneyfish.com/blog/how-to-tell-of-your-toyota-has-a-cts-or-denso-pedal/ … the CTS pictured has the sheetmetal cover over the bushing-axle interface.

I can’t account for the discrepancy where Paul’s sample was missing these covers.

It’s clear to me now that the CTS unit I examined already had the two side panel covers that protect the axle and bushings removed. I’m sorry I didn’t catch that earlier, in my haste and under the challenging circumstance of where the tear down took place (don’t ask). Sorry for the confusion. I’ve amended the text in the opening.

I’m no car expert, but temporarily living in Canada where a few articles here pointed out that the faulty CTS pedals were manufactured in Mississauga (suburb of Toronto). I wonder if other CTS plants produced faulty pedals? Haven’t seen anything about that. Could this one plant be doing something different/wrong?

I hear no definitive statement as to whether CTS produces pedals in both their US and Ca facilities, but I was trying to imagine that if they did, what would be the possible common cause for this issue…

Closest I could come up with is operator distraction:
– Indiana: Hunting or Basketball season
– Canada: Hockey Night in Canada.

I wonder if the “spacer” they’re talking about for CTS is actually a small ball bearing unit to replace the brass bushing? Then if the shaft interfered more with the bushing due to temperature or a foreign substance, it’d still turn.

1) Most manufacturers use sensor signals that both increase in value as the pedal is depressed, but the slope and offsets are different. For example, one track may go 0.5-4.5V as the pedal travels from 0 to 100%m, and the secondary track will follow with an output of 0.25-2.5V over the same mechanical range. The different slopes and offsets makes it easier to compensate for voltage offsets (each sensor gets its own ground and reference voltage) and enables some rational checks.

A few manufacturers use a third track (I believe the ’08 Ford Super Duty is one example of this). In this case, the third track does indeed use an inverse slope (usually a mirror of the first track described above).

2) If one wants to implement multiple slopes and offsets in a non-contacting (Hall effect or inductive sensing) design, it is very easy to do this with programming of the ASIC. A separate magnet is not required. In designs with contacting (potentiometric) sensors, the slope and offset is established by reference resistors that are printed onto the same substrate as the potentiometer.

Note that the use of a single magnet means that a mechanical failure (as well as various magnetic effects, such as the irreversable demagnetization that affects most permanent magnets) can cause sensor failure. Whether a manufacturer designs to use redundant magnets is determined by the risk assessments conducted by the supplier and OEM. Even small pieces of neodymium magnets aren’t cheap ($0.10 is a lot of money in a part that barely costs more than a super-sized value meal), so doubling up isn’t necessarily a path to a cost-competitive part.

3) I see all sorts of discussion about bushings and pivots, and the friction thereof, but everyone seems to be missing the fact that there is a device in the pedal (the so-called “hysteresis” mechanism) that intentionally adds more friction than even a defective pivot. Until someone chooses to understand the fine line between “just right” and “way too much” friction, the armchair engineers will focus their attention on the wrong area of the pedal.

Generating reliable and repeatable hysteresis is one of the most difficult tasks in designing an ETC pedal.

4) None of these parts are designed to be serviced. In fact, accessible fasteners (such as on the Denso part) are considered to be a safety hazard by many in the industry (they just beg to be tampered with by a mechanic or owner, and that can only lead to trouble). Many pedals are built with tamper-proof fasteners, or better yet, are assembled in such a way to make them impossible to disassemble without destroying the part.

5) Plastic is not a bad material for a part such as this. Some modern glass-reinforced materials approach the strength of cast aluminum (at least at room temp – this gets somewhat worse at the 85C max. temp limit that is considered “typical” for interior components). If metal were used for the pedal beam, it likely would need to be joined to some other material to create the required complex geometry for the pivot and sensor interface, and that just begs for trouble.

In summary – I know these pedals look simple and thus invite scrutiny from anyone with a bit of automotive knowledge, but please trust that they are much more complex than they would first appear.

>>Plastic is not a bad material for a part such as this. Some modern glass-reinforced materials approach the strength of cast aluminum (at least at room temp – this gets somewhat worse at the 85C max. temp limit that is considered “typical” for interior components). <<

Yes when a) production of the part is carefully controlled (much more carefully than for metals) and b) the part is brand new. For example, too high or low a molding temperature and the batch is bad, the wrong sizing on the glass fibers (too thick, too thin, wrong type) and you are sunk. Also, after 10 years the material's properties are anybody's guess. Accelerated testing? On materials that are very thermal history dependent (i.e. plastics) this is tricky indeed. Time-temperature superposition is ad hoc at best.

Again, this is not the case for the Toyota recall, just food for thought when you buy your next car.

Car is a full keyless go system. Fob stays in pocket or purse. You just walk up to the car and press a button on the door handle to unlock. When inside the car you just press the start button and drive. It’s a great system, and once you have used it, you will never want to go back to a key again. I cannot verify any of you other questions as car is buried under 12″ of partly cloudy and will not be driven till we get some serious melting as I am laid up from over shoveling. Whoever said life gets better when over 50 is full of sh*t! Wife will be driving my MDX till this nightmare is melted away, so hopefully someone else with an Avalon limited will pick up the ball and answer your remaining questions. Thanks again for your insight, and lets all hope for an accurate and rapid resolution. I for one will be happy to get a good nights sleep when this is properly resolved.

Wonderful analysis from both Paul and the collective genius of the B&B. One observation I’d like to offer, as a car reviewer: Toyota’s throttle response algorithms have to be some of the worst in the industry. Hell, even the positively ancient DBW system in my friend’s beat up 1996 Ford F350 Powerstroke is far superior, even with 320,000 miles on the vehicle. From a feel perspective, that is.

Many of the four-banger Toyota cars I’ve tested (Corolla S, for one) have terribly jumpy throttle mapping. Conversely, the 3.5L V6 models (Camry, ES, RX) have molasses in the throttle plates: there’s so much dead time before the V6 explodes into torque steer from a standstill and so much time to do a 6-3 downshift on the highway.

The whole affair is unbelievably non-linear. Which made me mash on the gas pedal WAY harder than other brands. I can’t help but wonder if an ECU re-flash will not only smooth out the throttle response and clean up the software code, but take the stress off gas pedals driven by leadfoots such as myself.

In these days of advanced electronics and computerising, ABS, drive by wire engine managment, and what have you, won’t it occur to some smart engineers to design a safety system that can overcome this? Lets say a system which would override the response to the foot throttle position, cause the engine to rev down, if the on board computer senses that the vehicle is at full throttle, and the brakes are being maximally applied, either in a sustained manner, or with multiple pumps,

My wife has a Corolla model 2009. In last september she had an episode o f sudden acceleration and a near accident in a street of our city. She was lucky to deviate to an empty avenue and managed to stop the car by pushing into neutral, pulling the park break and turning off the engine. After some days in dealer Toyota of Brasil stated that the matress provocked the incident. My wife disagreed with them.
Now the episode is clear, the problem is worldwide. Toyota of Brasil denies that there’s problem whith cars produced in Brasil.
The pedals of brazillian Corolla are produced by DENSO. Newspapers in my region reported four more cases of sudden acceleration. One of them led to an accident with total lose of the veihicle and driver’s light injuries.
I think that the greatest question is if are the pedals responsible for the problem? Brazillian Toyotas have problem of sudden acceleration and use DENSO pedals!
We are waiting for these anwers anxiously.

You raise an excellent question: Why would Toyota produce two differing designs? Seems odd to me, especially since the Toyota Production System is based on lean manufacturing where the idea is to reduce complexity, reduce waste, reduce duplication.

My guess is that it was to save a buck or two. Toyota has been wringing out costs for over a decade. CTS is not to blame necessarily if the manufacture met quality tolerances and durablity benchmarks. The problem was in its original design and engineering, combined with a desire to take cost out.

Being an electronics repair tech, and seeing the time frame of this accelerator issue, it seems to correlate with the masses of other electronics failures in the industry.

Namely the failures of tv sets, dvd players, and such.
The reason these are failing (usually just past warranty) is due to a bad batch (in the millions) of electrolytic capacitors.
(Google bad caps and read more about this juicy topic).

Since about 2002 when these Chinese-Made capacitors were being mounted on circuit boards of just about EVERYTHING, they’ve been popping, leaking, and causing ODD behavior, due to an improper manufacturing process of the electrolyte that causes premature failure.

With that said, has ANYbody examined the ECM’s of these cars?
A well placed potentially defective capacitor can trigger any number of disasterous behaviors in a circuit, and I’m sure these modules contain caps too.

I suspect if it IS a cap problem, and Toyota is covering the issue, it’s because of “Chinese Interests”.
Perhaps they’re just not aware….. yet?

And lord knows, we’ve ALL seen the recalls on Chinese products BEFORE!

Great insight, unfortunatly you people have no clue what your talking about. When taking apart the CTS pedal, I guess you failed to read the letters just below CTS that say PATENTED. Great speculation in to why Toyota would redesign the pedal from the Denso design, thats easy… because its not TOYOTA’s DESIGN. CTS + PATENTED = NOT TOYOTA DESIGN, make sense now?? Why did Ford recall almost 1700 CTS pedals in China on Transit vans?? Did Ford contract Toyota to design crappy pedals for them too and then get CTS to build them on top???

The media needs to start reporting news instead of making news!!! Sure people have died tragically, but didn’t a whole lot more people die when the whole Firestone/Ford tire thing happened. How many total dead and how many total models effected?? More died in Ford/Firestone recall with one affected model than Toyota/CTS AND there was not nearly as much media coverage and false speculation generated! (Thank you Brian Ross and ABC!!!) In typical American media fashion, you’ve turned this whole issue into the OJ Simpson trial of the auto industry, GOD HELP US ALL!!!!

Obviously this is not your Daddy’s simple stuck mechanical throttle linkage problem which I’m old enough to remember and have experianced. But, this certainly does appear to be a case of classic failure analysis where a series of chain of events is in place, and a break in the link would have prevented these tragedies.

This is somewhat in response to gsally’s post, because my initial thought was a software/firmware infinite loop. But, is the infinite loop caused by the sensor return it is reading, and doing exactly what it is suppose to do? Making it a mechanical failure of unknown and difficult to duplicate origin.

Throw in the lack of foresight to see the potential for this catastrophic failure, with no failsafe mechanism to simply kill the vehicle easily, and this is the result. Hopefully they will find, reveal the truth, and it will be interesting to see who’s conjecture is close.

Based upon your pictures, and the ABC TV and SIU professor video, and my plastic insert molding background, I will tell you what I think, my guess, is the root cause of the DENSO sudden acceleration problem.

Problem Definition; Toyota cars suddenly accelerate on their own.

1. The professeor at SIU by shorting out 2 “wires” can make the Toyota car accelerate full blast. I think the professor shorted out the wires in the wire harness coming of this pedal. He just knew if you shorted 2 of the wires that the car would take off full speed. The SIU professor said if you short out the 2 sensors in the pedal the car would take off.

It is my opinion that this insert molded housing is somehow shorting out. That is why the CTS design does not use a spring sandwhiched inbetween 2 plastic parts as a friction device.

FYI the pedal would have 2 sensors to see the postion of the pedal. If one sensor failed, the idiot light would go on … on your dash board, and the car would go into a limp home mode…. or something like that.

My guess is that there are 6 pin outs on the connector, 3 belog to one sensor , 3 belong to the other sensor. Based upon the 3 rows of 6 stamping support pins, there appears to be 6 “individual” stampings that have insert molded in this housing. It is these stampings that somehow short out.

2. The root cause is electricity is flowing from one of the stamping-support-holes in the cover, to another stamping support hole in the cover.

Let me explain stamping support holes first.
Several of you have commented on the 3 rows of 6 small holes (i guess the holes are .062 inches in diameter, and 1 mm deep). Someone correctly identified the holes as stamping support pins. Typically the stamping is squezed inbetween a pair of stamping support pins.

On the inside of this housing, you can see the shiny pure – tin (probably not tin-lead) plating on the copper stamping thur the holes left by the stamping support pins. Normally there are matching holes on the other side of the part. When plastic is squirted into the mold these stamping support pins, along with stamping support pins on the other side, or a sacrificial insert, or a premold, squeeze and hold the stamping in the middle of the plastic.

My guess is, that Somehow along this assemlby 2 of the 6 stamping traces short out amougst each other, causing instant excelleration in toyota cars

Here are possible ways how electricity can flow from one stamping circuit to another, even if all of these have to happen together. Keep in mind the stamping is probably .032 inches thick, 1.5 mm wide, CDA210 copper alloy, with tin plating. These “circuits” are probably spaced about 1.5 mm apart, inside the platic. It is possible that during molding some of these traces move closer to each other so the gap is say 1.0 mm … or less.

1. The spring wears and leaves metallic dust in the housing. the spring is metal, the dust builds up in two holes (holes left by stamping support pins) that are touching the spring, and short circuit occurs between 2 stamping traces. The dust from the plastic might contain carbon-black as a coloring agent which could conduct electicity.

2. During insert molding the plating flows off the stamping and makes a conductive path to the surface of the platic part. The resin the housing is made from wether it is pbt, or nylon (PA=polyamide-nylon), melt at 500 degrees F, and tin plating reflows at say 300F. With no lead in tin plating it melts at an even lower temp. The plating refow could cause a short. the plating could just reflow around a stamping support pin.

3. Each molded housing is most likely electrically tested with both ,a high-potential test, and a continuity test. If there is a short cicuit caused by (for example) say a wisker tin plating that was buried in the part, the hipot test would vaporize this “short cirucit”, but a carbon trail or someting remains in the plastic where this short was. If you test the part a 2nd time it would pass the hipot test and the housing could be deemed good. Coupled with other factors this could contribute to a short circuit. That is the remenants of what caused the short, but was burnt away, could contribute to a short later, even if it passed a subsequent hipot and continuity test.

4. If retractable stamping support pins are used on the outside of the housing (that is why you can not see the tin plating of the stamping on the outside) the knit line of these pins does not make a water tight seal. That is retractable stamping support pins leak, they do not make a hermetic sea. That is, the method used so as not to have stamping support pins visible on the outside of the housing, DOES leave a possible path for water to penetrate to the stamping. Perhaps moisture could collect on the outside of the housing and short out between these knit lines.

It is difficult to explain all the ways this pedal assembly, with insert molded housing, with stamping support pins, can short in a few lines, in a half hour of quick typing…
I’ll bet a virtual beer that i am corret on my guess